Manual:User Manager: Difference between revisions

From MikroTik Wiki
Jump to navigation Jump to search
← Older edit
No edit summary
 
(28 intermediate revisions by 2 users not shown)
Line 1: Line 1:
== [[User Manager/Introduction | Introduction ]] ==
== Introduction ==


User manager (UM) is a management system that can be used in various setups. UM can be used for HotSpot, PPP, DHCP, Wireless and RouterOS users. User Manager is a [http://en.wikipedia.org/wiki/RADIUS RADIUS] '''server''' application. The first UM test package was introduced in RouterOS version 4. User manager package is supported on all RouterOS architectures including x86 and Cloud Host Router.
User manager (UM) is a management system that can be used in various setups. UM can be used for HotSpot, PPP, DHCP, Wireless and RouterOS users. User Manager is a [http://en.wikipedia.org/wiki/RADIUS RADIUS] '''server''' application. The first UM test package was introduced in RouterOS version 4. User manager package is supported on all RouterOS architectures including x86 and Cloud Host Router.
Line 5: Line 5:
{{ Note | SMIPS based devices without additional memory do not have enough free space for UM package. }}
{{ Note | SMIPS based devices without additional memory do not have enough free space for UM package. }}


== [[User Manager/Getting started | Getting started]] ==
===  Getting started ===
* [[User Manager/Getting started #Download | Download]]
 
* [[User Manager/Getting started #Install | Install]]
MikroTik User Manager can be downloaded from the MikroTik web site [http://www.mikrotik.com/download.html download] section. In there find the system and software version that you need this package for and download '''Extra packages''' archive for it. In this archive, you will find the User Manager package. To install the package simply upload it on the device and reboot the unit.
* [[User Manager/Getting started #Create first subscriber | Create first subscriber]]
 
* [[User Manager/Getting started #Use web interface | First log on User Manager web]]
A default Customer with login '''admin''' and '''empty password''' is created when the User Manager package is installed for the first time.
 
<pre>
[admin@MikroTik] /tool user-manager customer set admin password=adminpassword
</pre>
 
After that, you can use print command to see what you have added.
 
<pre>
[admin@MikroTik] /tool user-manager customer> print
  Flags: X - disabled
  0  login="admin" password="adminpassword" backup-allowed=yes currency="USD"
      time-zone=-00:00 permissions=owner signup-allowed=no paypal-allowed=no
      paypal-secure-response=no paypal-accept-pending=no
</pre>
 
== Quick start ==
== Quick start ==
* [[User Manager/Hotspot Example | User Manager and HotSpot]]
* [[User Manager/Hotspot Example | User Manager and HotSpot]]
Line 17: Line 32:
* [[User Manager/RouterOS_user_Example | User Manager and RouterOS user]]
* [[User Manager/RouterOS_user_Example | User Manager and RouterOS user]]


== Concepts explained ==
= Concepts explained =
=== Common ===
===Customers===
* [[User Manager/Customers | Customers]]
 
* [[User Manager/Users | Users]]
<p id="shbox"><b>Sub-menu:</b> <code>/tool user-manager customer</code></p>
* [[User Manager/Sessions | Sessions]]
 
* [[User Manager/Payments | Payments]]
 
* [[User Manager/Logs | Logs]]
Customers use a web interface to manage users, credits, routers, etc. Each customer can have a zero or more sub-customers and exactly one parent-customer with the same or weaker [https://wiki.mikrotik.com/wiki/User_Manager/Permissions permission] level than its parent.
* [[User Manager/Permissions | Customer permission levels]]
 
* [[User Manager/Character constants | Character constants]]
Subscriber is a customer with owner permissions who's a parent is himself. Subscribers can be thought as domain - each subscriber sees everything that happens with his sub-customers,
* [[User Manager/Active sessions | Active sessions]]
credits, users, routers, sessions, etc., but has no access to other subscriber's data.
* [[User Manager/Public ID | Customer public ID]]
All data objects (users, routers, credits, logs) belong to one specific subscriber and can, therefore, belong to many sub-customers of the owner subscriber. To separate users among customers of one subscriber, user prefix is used.
 
 
{{Mr-arg-table-h
|prop=Property
|desc=Description
}}
 
{{Mr-arg-table
|arg=access
|type=config-payment-gw {{!}} own-profiles {{!}} own-users {{!}} parent-payment-gw {{!}} parent-routers {{!}} own-limits {{!}} own-routers {{!}} parent-limits {{!}} parent-profiles {{!}} parent-users
|default=
|desc=Configureable parameters
* <var>config-payment-gw</var>
* <var>own-limits </var>
* <var>own-profiles</var>
* <var>own-routers</var>
* <var>own-users </var>
* <var>parent-limits</var>
* <var>parent-payment-gw</var>
* <var>parent-profiles</var>
* <var>parent-routers</var>
* <var>parent-users</var>
}}
 
{{Mr-arg-table
|arg=backup-allowed
|type=yes {{!}} no
|default=yes
|desc=Allow to manage backups.
}}
 
{{Mr-arg-table
|arg=city
|type=string
|default=
|desc=<span style="color:#a2a9b1">''Informational''</span>
}}
 
{{Mr-arg-table
|arg=company
|type=string
|default=
|desc=<span style="color:#a2a9b1">''Informational''</span>
}}
 
{{Mr-arg-table
|arg=copy-from
|type=string
|default=
|desc=Copy data from a specific customer.
}}
 
{{Mr-arg-table
|arg=country
|type=string
|default=
|desc=''Informational''
}}
 
{{Mr-arg-table
|arg=currency
|type=string
|default=
|desc=Used for payments and money-related data representation on the web page.
}}
 
{{Mr-arg-table
|arg=date-format
|type=string
|default=
|desc=Used on web pages for data representation. Only allowed formats (listed in the drop-down) can be used. When the value doesn't match any of allowed (it's possible to enter any value from console) formats, default is used.
}}
 
{{Mr-arg-table
|arg=disabled
|type=yes {{!}} no
|default=no
|desc=Allow to disable/enable customer.
}}
 
{{Mr-arg-table
|arg=email
|type=string
|default=
|desc=Email address. Used to send emails (for ex., sign up information) to users.
}}
 
{{Mr-arg-table
|arg=parent
|type=string
|default=
|desc=Customers parent.
}}
 
{{Mr-arg-table
|arg=password
|type=string
|default=
|desc=
}}
 
{{Mr-arg-table
|arg=paypal-accept-pending=
|type=yes {{!}} no
|default=no
|desc=When true, payments with status "Pending" are accepted as valid. This may be used for multi-currency payments where manual approvals must be made.
}}
 
{{Mr-arg-table
|arg=paypal-allowed=
|type=yes {{!}} no
|default=no
|desc=Whether [https://wiki.mikrotik.com/wiki/User_Manager/User_payments#PayPal Paypal] is allowed.
}}
 
{{Mr-arg-table
|arg=paypal-business-id
|type=string
|default=no
|desc=Business ID of the PayPal account where the money will be sent.
}}
 
{{Mr-arg-table
|arg=paypal-secure-response
|type=yes {{!}} no
|default=no
|desc=Whether to use HTTPS (when true) or HTTP (when false) to receive payment feedback from PayPal. An additional security mechanism is used to check the validity of this feedback information so using HTTP is not mandatory.
}}
 
{{Mr-arg-table
|arg=permissions
|type=full {{!}} owner {{!}} read-only {{!}} read-write
|default=owner
|desc=Customer account [https://wiki.mikrotik.com/wiki/User_Manager/Permissions permissions].
}}
 
{{Mr-arg-table
|arg=public-host
|type=string
|default=
|desc=IP address or DNS name specifying the public address of this User Manager router. Payment gateways use this address to send transaction status response. This field has sense only if users access the User Manager site through local IP address (for, example, http://192.168.0.250/user) and another address is used for public access (for example, http://userman.mt.lv/user).
}}
 
{{Mr-arg-table
|arg=public-id
|type=string
|default=
|desc= It's an ID used to identify customer because Login names are allowed to be equal and for security reasons, they are kept in secret.
}}
 
{{Mr-arg-table
|arg=signup-allowed=
|type=yes {{!}} no
|default=no
|desc=When checked, this customer allows users to use [https://wiki.mikrotik.com/wiki/User_Manager/User_sign_up sign-up].
}}
 
{{Mr-arg-table
|arg=time-zone
|type=string
|default=
|desc=Specific for each customer. By default equals to 00:00. Session and credit info is stored as GMT regardless of ROS time zone on the User Manager router. This value specifies the way data is displayed on the User Manager web pages.
}}
 
{{Mr-arg-table
|arg=user-prefix
|type=string
|default=
|desc=Used to separate users between customers of one subscriber.
}}
 
{{Mr-arg-table-end
|arg=login
|type=string
|default=
|desc=
}}
 
 
A WEB interface provides the same options as CLI. Usually, people choose to use "User managers" WEB interface, because it is more transparent and comfortable to manage.
[[File:Customer-section.png|center|thumb|1000x500px|alt=Alt text|Customer section in the WEB inteface]]
 
===Users===
 
<p id="shbox"><b>Sub-menu:</b> <code>/tool user-manager user</code></p>
<br>
Users are people who use services provided by customers and each user can have time, traffic and speed limitations. Customers can create, modify and delete users but the owner is the subscriber who is also the owner of these customers. To separate users among customers of one subscriber, user prefix is used.
 
{{Mr-arg-table-h
|prop=Property
|desc=Description
}}
 
{{Mr-arg-table
|arg=caller-id 
|type=string
|default=
|desc=
}}
 
{{Mr-arg-table
|arg=caller-id-bind-on-first-use
|type= yes {{!}} no
|default=no
|desc=
}}
 
{{Mr-arg-table
|arg=copy-from
|type=string
|default=
|desc=Copy parameters from specific user.
}}
 
{{Mr-arg-table
|arg=disabled
|type=yes {{!}} no
|default=no
|desc=Whether user is disabled.
}}
 
{{Mr-arg-table
|arg=email
|type=string
|default=
|desc=Email. Used to send notifications to User (for ex., sign-up email).
}}
 
{{Mr-arg-table
|arg=first-name
|type=string
|default=
|desc=<span style="color:#a2a9b1">''Informational''</span>
}}
 
{{Mr-arg-table
|arg=ip-address
|type=string
|default=
|default=0.0.0.0.
|desc=If not blank, User will get this IP address on successful authorization.
}}
 
{{Mr-arg-table
|arg=last-name
|type=string
|default=
|desc=<span style="color:#a2a9b1">''Informational''</span>
}}
 
{{Mr-arg-table
|arg=location
|type=string
|default=
|desc=<span style="color:#a2a9b1">''Informational''</span>
}}
 
{{Mr-arg-table
|arg=password
|type=string
|default=
|desc=
}}
 
{{Mr-arg-table
|arg=phone
|type=string
|default=
|desc=<span style="color:#a2a9b1">''Informational''</span>
}}
 
 
{{Mr-arg-table
|arg=random-password
|type=yes {{!}} no
|default=no
|desc=Randomly generates password for a user.
}}
 
{{Mr-arg-table
|arg=reg-key
|type=string
|default=
|desc=
}}
 
{{Mr-arg-table
|arg=registration-date
|type=string
|default=
|desc=
}}
 
{{Mr-arg-table
|arg=shared-users
|type=number {{!}} unlimited
|default=unlimited
|desc=
}}
 
{{Mr-arg-table
|arg=username
|type=string
|default=
|desc=
}}
 
{{Mr-arg-table
|arg=wireless-enc-algo
|type=40bit-wep {{!}} 104bit-wep {{!}} aes-ccm {{!}} none {{!}} tkip
|default=
|desc=
}}
 
{{Mr-arg-table
|arg=wireless-enc-key
|type=string
|default=
|desc=
}}
 
{{Mr-arg-table
|arg=wireless-psk
|type=string
|default=
|desc=
}}
 
{{Mr-arg-table-end
|arg=customer
|type=string
|default=
|desc=User account owner.
}}
 
===Profile===
 
<p id="shbox"><b>Sub-menu:</b> <code>/tool user-manager profile</code></p>
 
 
Profiles can be assigned to users manually or allocated by the user when they make a successful payment.
 
If the Profile property 'Starts' is set to 'At first Logon', the Profile assigned to a user is inactive until that user logs on to the system (e.g. via a Hotspot). When the user starts a new session, that User's 'start time' is fixed and accordingly the 'end time' is calculated. The 'end time' cannot then be changed, no matter if the session remains active until the 'end time' or the session closes sooner.
 
If the user has several profiles, the next inactive profile is then started (it's activated as the 'actual profile') when the previous actual profile reaches it's 'end time'. If there are no more inactive profiles to start, the user is forced to log off.
 
If there is already one active profile when a user logs on, this profile is used instead of starting the next one (if one is available).
 
If the user logs off before the profile's 'end time', the next inactive profile is started only when the user logs on again after the 'end time' of the earlier profile.
 
Only one profile (for the same user) can be active at a time.
 
The last profile of a user can be removed by customer only if it is inactive.
 
 
{{Mr-arg-table-h
|prop=Property
|desc=Description
}}
 
{{Mr-arg-table
|arg=copy-from
|type=string
|default=
|desc=Copy data from specific customer.
}}
 
{{Mr-arg-table
|arg=name-for-users
|type=string
|default=
|desc= Descriptive name for the Profile that is displayed to the end user when they login to their user page.
}}
 
{{Mr-arg-table
|arg=override-shared-users=
|type=off {{!}} unlimited
|default=off
|desc=
}}
 
{{Mr-arg-table
|arg=price
|type=string
|default=
|desc=How much it will cost for the user. If left blank, there is no payment required.
}}
 
{{Mr-arg-table
|arg=starts-at
|type=logon {{!}} now
|default=logon
|desc=When time limitation starts.
}}
 
{{Mr-arg-table
|arg=validity
|type=string
|default=
|desc=Defines the period of time the Profile is valid for. (Note: NOT the same as the online time that could be set in Limitations).
}}
 
{{Mr-arg-table
|arg=name
|type=string
|default=
|desc=
}}
 
{{Mr-arg-table-end
|arg=owner
|type=string
|default=
|desc=The 'Owner' of the Profile (usually 'admin').
}}
<br>
 
<var>Validity</var> If the 'Starts' value is set to 'At first logon', then the Validity value starts counting. E.g. If Validity is set to 1d, then 1 day after the first logon, regardless if the user has used all their online time or not, the profile will become invalid and they will be unable to log on again unless a new profile is available in their list of valid profiles.
 
{{ Note | If the 'Starts' value is set to 'At first logon', then the Validity value starts counting. E.g. If Validity is set to 1d, then 1 day after the first logon, regardless if the user has used all their online time or not, the profile will become invalid and they will be unable to log on again unless a new profile is available in their list of valid profiles. }}
 
====Limitation====
 
<p id="shbox"><b>Sub-menu:</b> <code>/tool user-manager profile limitation</code></p>
<br>
In this subsection, you can configure upload/download limitations including bursts.
 
{{Mr-arg-table-h
|prop=Property
|desc=Description
}}
 
{{Mr-arg-table
|arg=address-list
|type=string
|default=
|desc=Copy data from a specific Customer.
}}
 
{{Mr-arg-table
|arg=copy-from
|type=string
|default=
|desc=Copy data from a specific Profile.
}}
 
{{Mr-arg-table
|arg=download-limit
|type=number
|default=
|desc=Speciffy a download limit.
}}
 
{{Mr-arg-table
|arg=group-name
|type=string
|default=
|desc=
}}
 
{{Mr-arg-table
|arg=ip-pool
|type=ip-prefix
|default=0.0.0.0
|desc=
}}
 
{{Mr-arg-table
|arg=rate-limit-...
|type=number
|default=
|desc=Various rate limits:
* <var>rate-limit-burst-rx</var>
* <var>rate-limit-burst-time-tx</var>
* <var>rate-limit-burst-treshold-tx</var>
* <var>rate-limit-min-rx</var>
* <var>rate-limit-priority</var>
* <var>rate-limit-tx</var>
* <var>rate-limit-burst-time-rx</var>
* <var>rate-limit-burst-treshold-rx</var>
* <var>rate-limit-burst-tx</var>
* <var>rate-limit-min-tx</var>
* <var>rate-limit-rx</var>
}}
 
{{Mr-arg-table
|arg=transfer-limit
|type=number
|default=
|desc=
}}
 
{{Mr-arg-table
|arg=upload-limit
|type=number
|default=
|desc=
}}
 
{{Mr-arg-table
|arg=uptime-limit
|type=number
|default=
|desc=
}}
 
{{Mr-arg-table
|arg=name
|type=string
|default=
|desc=Used to identify a Profile limitations.
}}
 
{{Mr-arg-table-end
|arg=owner
|type=string
|default=
|desc=Profile limitations owner.
}}
<br>
 
====Profile limitations====
 
 
<p id="shbox"><b>Sub-menu:</b> <code>/tool user-manager profile profile-limitation</code></p>
<br>
In this subsection, you can configure various limitations, for example, time range and weekdays when limitations are active.
 
{{Mr-arg-table-h
|prop=Property
|desc=Description
}}
 
{{Mr-arg-table
|arg=copy-from
|type=string
|default=
|desc=Copy data from specific profile-limitations.
}}
 
{{Mr-arg-table
|arg=from-time
|type=number
|default=
|desc=
}}
 
{{Mr-arg-table
|arg=till-time
|type=number
|default=
|desc=
}}
 
{{Mr-arg-table
|arg=weekdays
|type=friday {{!}}  monday {{!}} saturday {{!}} sunday {{!}} thursday {{!}} tuesday {{!}} wednesday
|default=all
|desc=Specific day or days when profile-limitations are active.
}}
 
{{Mr-arg-table
|arg=limitation
|type=string
|default=
|desc=
}}
 
{{Mr-arg-table-end
|arg=profile
|type=string
|default=
|desc=Profile to which assign limitations.
}}
 
===Routers===
 
<p id="shbox"><b>Sub-menu:</b> <code>/tool user-manager router</code></p>
<br>
This submenu allows for adding routers.
 
{{Mr-arg-table-h
|prop=Property
|desc=Description
}}
 
{{Mr-arg-table
|arg=copy-from
|type=string
|default=
|desc=Copy data from specific router.
}}
 
{{Mr-arg-table
|arg=log
|type=acct-fail {{!}}  acct-ok {{!}} auth-fail {{!}} auth-ok
|default=auth-fail
|desc=To allow logging entries.
}}
 
{{Mr-arg-table
|arg=name
|type=string   
|default=
|desc=Used to identify a router.
}}
 
{{Mr-arg-table
|arg=shared-secret
|type=string
|default=
|desc=
}}
 
{{Mr-arg-table
|arg=use-coa
|type=yes {{!}} no
|default=no
|desc=
}}
 
{{Mr-arg-table
|arg=customer
|type=string
|default=
|desc=Customer to a which router will be assigned.
}}
 
{{Mr-arg-table-end
|arg=ip-address
|type=string
|default=
|desc=Router IP address.
}}
 
===History===
 
<p id="shbox"><b>Sub-menu:</b> <code>/tool user-manager history</code></p>
<br>
This subsection allows overviewing any changes confirmed in UM database. Some of them can be reverted back.
 
<pre>
[admin@MikroTik] /tool user-manager history> print
Flags: U - undoable, R - redoable, F - failed
  ACTION                                                                                                                                                          SUB-CHANGES TIME               
U UMS customer test1 added                                                                                                                                                    may/22/2019 13:26:07
U UMS Profile test added                                                                                                                                                      may/22/2019 13:25:57
U multiple objects removed                                                                                                                                                    may/22/2019 12:02:37
U UMS customer customer1 added                                                                                                                                                may/22/2019 12:00:29
U UMS user user1 added                                                                                                                                                        may/22/2019 12:00:17
U UMS Profile testprofile added                                                                                                                                              may/22/2019 11:47:06
U multiple objects removed                                                                                                                                                  2 may/22/2019 11:14:53
U UMS user kkol added                                                                                                                                                        may/22/2019 10:53:57
U UMS user testtest added                                                                                                                                                    may/22/2019 10:45:53
U UMS Profile testu added                                                                                                                                                    may/22/2019 10:33:31
U UMS customer test added                                                                                                                                                    may/22/2019 10:09:35
</pre>
 
===Log===
 
<p id="shbox"><b>Sub-menu:</b> <code>/tool user-manager log</code></p>
<br>
Logs are written when Authorization (auth) or Accounting (acct) requests from routers are received.
 
<pre>
[admin@MikroTik] > tool user-manager log print
0 customer=admin user-orig="Client1" nas-port=15728780 nas-port-type=ethernet nas-port-id="bridge-to-clients"
  calling-station-id="01:23:45:67:E1:BB" host-ip=172.16.16.1 status=authorization-failure time=may/23/2019 06:34:59
  description="no valid profile found for user <Client1>"
</pre>
 
Send User Manager related logging entries to the different device:
<pre>
/system logging add topics=manager,account action=remote
/system logging action set remote target=remote remote=192.168.88.1:514
</pre>
 
===Session===
 
<p id="shbox"><b>Sub-menu:</b> <code>/tool user-manager session</code></p>
<br>
 
A session refers to a period when a user is using customer's services. It has nothing to do with User Manager web-page sessions.
Flags: A - active
<pre>
[admin@MikroTik] > tool user-manager session print
 
1 A customer=admin user="test" nas-port=15728795 nas-port-type=ethernet nas-port-id="bridge-to-clients"
    calling-station-id="01:23:45:67:E1:BB" acct-session-id="81d0009b" user-ip=172.16.16.253 host-ip=172.16.16.1
    status=start,interim from-time=may/23/2019 08:55:43 till-time=may/23/2019 09:25:43 uptime=30m download=38 upload=4533
</pre>
 
 
= Web Interface =
To access User managers Web interface type IP address and /Userman at the end of it, for example, http://192.168.88.1/userman
 
[[File:UM-login.png|center|frame|alt=Alt text|Default login is '''admin''' with empty password]]
 
{{ Note | Since RouterOS 4.1, User-manager web interface is unreachable with an HTTP 404 when attempting to navigate to http://inside_ip/userman from behind a Hotspot interface where inside_ip is a non-NAT'd IP address on the router. Two workarounds: change the 'www' service port from 80 to something other than 80 or 8080, such as port 81. Then use http://inside_ip:81/userman, or use an IP address hotspot users are NAT'd to (http://outside_ip/userman) instead. }}
 
= Configuration Examples =
 
We will configure PPPoE with the RADIUS server authentication on the following setup:
[[file:Diagram1.png|400px|center|thumb|alt=Alt text| Setup where the PPPoE server uses a remote User Manager database for PPPoE client authentication, authorization and accounting. Both PPPoE server and PPPoE client are MikroTik routers, any other PPPoE client might be used instead. ]]
On the client's (R1) router we configure PPPoE-client:
<pre>
[admin@R1] > /interface pppoe-client
add add-default-route=yes disabled=no interface=ether2 name=Client1 password=test user=test
</pre>
<br>
Add RADIUS client to consult User Manager for PPP service<br>
<code>secret</code> is equal to User Manager router secret. <code>192.168.79.24</code> is the User Manager router address.
<pre>
[admin@R2] > /radius
add address=192.168.79.24 secret=12345 service=ppp
</pre>
There are 2 ways how to assign IP address for the PPPoE-client:
*Create a pool from which assign IP addresses dynamically in the RADIUS client
*Configure IP address manually in the RADIUS server
<pre>
# Dynamically assign IP addresses
[admin@R2] > /ip pool
add name=pool1 ranges=192.168.79.30-192.168.79.50
</pre>
 
Create a new one or update the default ppp profile:
<pre>
[admin@R2] > /ppp profile set [find name=default] remote-address=pool1 local-address=192.168.79.1
</pre>
Enable user authentication via RADIUS. If entry in local secret database is not found, then client will be authenticated via RADIUS
<pre>
[admin@R2] > /ppp aaa
set use-radius=yes
</pre>
 
 
On the RADIUS server (User Manager, R3):
 
Create your own or use by default already created Customer:
<pre>
[admin@R3] > /tool user-manager customer
set admin access=own-routers,own-users,own-profiles,own-limits,config-payment-gw
</pre>
 
Create a profile which you will asing to user. can consist only a <code>name</code> ([https://wiki.mikrotik.com/wiki/Manual:User_Manager#Profile additional parameters] can be updated later)
<pre>
[admin@R3] > /tool user-manager profile
add name=profile1
</pre>


=== Version 4.x test package specific ===
Configure User Manager (RADIUS server) communication with RADIUS client<br>
* [[User Manager/Profiles | Profiles]]
192.168.79.1 is the IP address of the PPPoE-server router, <code>shared-secret</code> should match on both User Manager and PPPoE-server routers
* [[User Manager/MAC binding | MAC binding]]
<pre>
* [[User Manager/Languages | Languages]]
[admin@R3] >/tool user-manager router
add customer=admin ip-address=192.168.79.1 log=auth-fail name=router1 shared-secret=12345
</pre>


=== Version 3.x specific ===
Add a user which will authenificate through the RADIUS server. Previously mentioned static IP address should be configured in this sub-section under <code>ip-address=</code> parameter.
* [[User Manager/Subscribers | Subscribers]]
<pre>
* [[User Manager/Credits | Credits ]]
/tool user-manager user
* [[User Manager/User prefix | User prefix]]
add customer=admin disabled=no password=test shared-users=1 username=test
* [[User Manager/Limiting | Time, traffic amount and rate limiting ]]
</pre>
* [[User Manager/Prepaid and unlimited users | Prepaid and unlimited users]]
Activate a user:
* [[User Manager/Voucher template | Voucher template]]
<pre>
[admin@R3] /tool user-manager> user create-and-activate-profile test customer=admin profile=profile1
</pre>
<br>
Monitoring information from <code>R1</code> device:
<pre>
[admin@R1] > interface pppoe-client monitor Client1
          status: connected
          uptime: 1h48m42s
    active-links: 1
        encoding:
    service-name: service1
        ac-name: R2
          ac-mac: 01:23:45:67:8D:49
            mtu: 1480
            mru: 1480
  local-address: 192.168.79.50
  remote-address: 192.168.79.1
</pre>


== Reference ==
= Reference =
=== Web interface ===
Articles kept from User Manager in RouterOS v3+
* [[User Manager/Search patterns | Search patterns]]
* [[User Manager/Tables | Tables]]:
** [[User Manager/Tables #Sorting | Sorting]]
** [[User Manager/Tables #Filtering | Filtering]]
** [[User Manager/Tables #Division in pages | Division in pages]]
** [[User Manager/Tables #Multiple object selection | Multiple object selection]]
** [[User Manager/Tables #Operations with selected objects | Operations with selected objects]]
** [[User Manager/Tables #Minimization | Minimization]]
** [[User Manager/Tables #Links to detail form | Links to detail form]]
* [[User Manager/Detail forms | Detail forms]]
* [[User Manager/Printing | Page printing]]
=== [[User Manager/Customer page | Customer page]] ===
=== [[User Manager/Customer page | Customer page]] ===
* [[User Manager/Customer page #Setup | Setup]]
* [[User Manager/Customer page #Setup | Setup]]

Latest revision as of 10:31, 30 September 2020

Introduction

User manager (UM) is a management system that can be used in various setups. UM can be used for HotSpot, PPP, DHCP, Wireless and RouterOS users. User Manager is a RADIUS server application. The first UM test package was introduced in RouterOS version 4. User manager package is supported on all RouterOS architectures including x86 and Cloud Host Router.

Note: SMIPS based devices without additional memory do not have enough free space for UM package.


Getting started

MikroTik User Manager can be downloaded from the MikroTik web site download section. In there find the system and software version that you need this package for and download Extra packages archive for it. In this archive, you will find the User Manager package. To install the package simply upload it on the device and reboot the unit.

A default Customer with login admin and empty password is created when the User Manager package is installed for the first time. 

[admin@MikroTik] /tool user-manager customer set admin password=adminpassword

After that, you can use print command to see what you have added. 

 [admin@MikroTik] /tool user-manager customer> print
  Flags: X - disabled
   0   login="admin" password="adminpassword" backup-allowed=yes currency="USD" 
       time-zone=-00:00 permissions=owner signup-allowed=no paypal-allowed=no
       paypal-secure-response=no paypal-accept-pending=no

Quick start

Concepts explained

Customers

Sub-menu: /tool user-manager customer


Customers use a web interface to manage users, credits, routers, etc. Each customer can have a zero or more sub-customers and exactly one parent-customer with the same or weaker permission level than its parent.

Subscriber is a customer with owner permissions who's a parent is himself. Subscribers can be thought as domain - each subscriber sees everything that happens with his sub-customers, credits, users, routers, sessions, etc., but has no access to other subscriber's data. All data objects (users, routers, credits, logs) belong to one specific subscriber and can, therefore, belong to many sub-customers of the owner subscriber. To separate users among customers of one subscriber, user prefix is used.


Property Description
access (config-payment-gw | own-profiles | own-users | parent-payment-gw | parent-routers | own-limits | own-routers | parent-limits | parent-profiles | parent-users; Default: ) Configureable parameters
  • config-payment-gw
  • own-limits
  • own-profiles
  • own-routers
  • own-users
  • parent-limits
  • parent-payment-gw
  • parent-profiles
  • parent-routers
  • parent-users
backup-allowed (yes | no; Default: yes) Allow to manage backups.
city (string; Default: ) Informational
company (string; Default: ) Informational
copy-from (string; Default: ) Copy data from a specific customer.
country (string; Default: ) Informational
currency (string; Default: ) Used for payments and money-related data representation on the web page.
date-format (string; Default: ) Used on web pages for data representation. Only allowed formats (listed in the drop-down) can be used. When the value doesn't match any of allowed (it's possible to enter any value from console) formats, default is used.
disabled (yes | no; Default: no) Allow to disable/enable customer.
email (string; Default: ) Email address. Used to send emails (for ex., sign up information) to users.
parent (string; Default: ) Customers parent.
password (string; Default: )
paypal-accept-pending= (yes | no; Default: no) When true, payments with status "Pending" are accepted as valid. This may be used for multi-currency payments where manual approvals must be made.
paypal-allowed= (yes | no; Default: no) Whether Paypal is allowed.
paypal-business-id (string; Default: no) Business ID of the PayPal account where the money will be sent.
paypal-secure-response (yes | no; Default: no) Whether to use HTTPS (when true) or HTTP (when false) to receive payment feedback from PayPal. An additional security mechanism is used to check the validity of this feedback information so using HTTP is not mandatory.
permissions (full | owner | read-only | read-write; Default: owner) Customer account permissions.
public-host (string; Default: ) IP address or DNS name specifying the public address of this User Manager router. Payment gateways use this address to send transaction status response. This field has sense only if users access the User Manager site through local IP address (for, example, http://192.168.0.250/user) and another address is used for public access (for example, http://userman.mt.lv/user).
public-id (string; Default: ) It's an ID used to identify customer because Login names are allowed to be equal and for security reasons, they are kept in secret.
signup-allowed= (yes | no; Default: no) When checked, this customer allows users to use sign-up.
time-zone (string; Default: ) Specific for each customer. By default equals to 00:00. Session and credit info is stored as GMT regardless of ROS time zone on the User Manager router. This value specifies the way data is displayed on the User Manager web pages.
user-prefix (string; Default: ) Used to separate users between customers of one subscriber.
login (string; Default: )


A WEB interface provides the same options as CLI. Usually, people choose to use "User managers" WEB interface, because it is more transparent and comfortable to manage.

Alt text
Customer section in the WEB inteface

Users

Sub-menu: /tool user-manager user


Users are people who use services provided by customers and each user can have time, traffic and speed limitations. Customers can create, modify and delete users but the owner is the subscriber who is also the owner of these customers. To separate users among customers of one subscriber, user prefix is used.

Property Description
caller-id (string; Default: )
caller-id-bind-on-first-use (yes | no; Default: no)
copy-from (string; Default: ) Copy parameters from specific user.
disabled (yes | no; Default: no) Whether user is disabled.
email (string; Default: ) Email. Used to send notifications to User (for ex., sign-up email).
first-name (string; Default: ) Informational
ip-address (string; Default: 0.0.0.0.) If not blank, User will get this IP address on successful authorization.
last-name (string; Default: ) Informational
location (string; Default: ) Informational
password (string; Default: )
phone (string; Default: ) Informational
random-password (yes | no; Default: no) Randomly generates password for a user.
reg-key (string; Default: )
registration-date (string; Default: )
shared-users (number | unlimited; Default: unlimited)
username (string; Default: )
wireless-enc-algo (40bit-wep | 104bit-wep | aes-ccm | none | tkip; Default: )
wireless-enc-key (string; Default: )
wireless-psk (string; Default: )
customer (string; Default: ) User account owner.

Profile

Sub-menu: /tool user-manager profile


Profiles can be assigned to users manually or allocated by the user when they make a successful payment.

If the Profile property 'Starts' is set to 'At first Logon', the Profile assigned to a user is inactive until that user logs on to the system (e.g. via a Hotspot). When the user starts a new session, that User's 'start time' is fixed and accordingly the 'end time' is calculated. The 'end time' cannot then be changed, no matter if the session remains active until the 'end time' or the session closes sooner.

If the user has several profiles, the next inactive profile is then started (it's activated as the 'actual profile') when the previous actual profile reaches it's 'end time'. If there are no more inactive profiles to start, the user is forced to log off.

If there is already one active profile when a user logs on, this profile is used instead of starting the next one (if one is available).

If the user logs off before the profile's 'end time', the next inactive profile is started only when the user logs on again after the 'end time' of the earlier profile.

Only one profile (for the same user) can be active at a time.

The last profile of a user can be removed by customer only if it is inactive.


Property Description
copy-from (string; Default: ) Copy data from specific customer.
name-for-users (string; Default: ) Descriptive name for the Profile that is displayed to the end user when they login to their user page.
override-shared-users= (off | unlimited; Default: off)
price (string; Default: ) How much it will cost for the user. If left blank, there is no payment required.
starts-at (logon | now; Default: logon) When time limitation starts.
validity (string; Default: ) Defines the period of time the Profile is valid for. (Note: NOT the same as the online time that could be set in Limitations).
name (string; Default: )
owner (string; Default: ) The 'Owner' of the Profile (usually 'admin').


Validity If the 'Starts' value is set to 'At first logon', then the Validity value starts counting. E.g. If Validity is set to 1d, then 1 day after the first logon, regardless if the user has used all their online time or not, the profile will become invalid and they will be unable to log on again unless a new profile is available in their list of valid profiles.

Note: If the 'Starts' value is set to 'At first logon', then the Validity value starts counting. E.g. If Validity is set to 1d, then 1 day after the first logon, regardless if the user has used all their online time or not, the profile will become invalid and they will be unable to log on again unless a new profile is available in their list of valid profiles.


Limitation

Sub-menu: /tool user-manager profile limitation


In this subsection, you can configure upload/download limitations including bursts.

Property Description
address-list (string; Default: ) Copy data from a specific Customer.
copy-from (string; Default: ) Copy data from a specific Profile.
download-limit (number; Default: ) Speciffy a download limit.
group-name (string; Default: )
ip-pool (ip-prefix; Default: 0.0.0.0)
rate-limit-... (number; Default: ) Various rate limits:
  • rate-limit-burst-rx
  • rate-limit-burst-time-tx
  • rate-limit-burst-treshold-tx
  • rate-limit-min-rx
  • rate-limit-priority
  • rate-limit-tx
  • rate-limit-burst-time-rx
  • rate-limit-burst-treshold-rx
  • rate-limit-burst-tx
  • rate-limit-min-tx
  • rate-limit-rx
transfer-limit (number; Default: )
upload-limit (number; Default: )
uptime-limit (number; Default: )
name (string; Default: ) Used to identify a Profile limitations.
owner (string; Default: ) Profile limitations owner.


Profile limitations

Sub-menu: /tool user-manager profile profile-limitation


In this subsection, you can configure various limitations, for example, time range and weekdays when limitations are active.

Property Description
copy-from (string; Default: ) Copy data from specific profile-limitations.
from-time (number; Default: )
till-time (number; Default: )
weekdays (friday | monday | saturday | sunday | thursday | tuesday | wednesday; Default: all) Specific day or days when profile-limitations are active.
limitation (string; Default: )
profile (string; Default: ) Profile to which assign limitations.

Routers

Sub-menu: /tool user-manager router


This submenu allows for adding routers.

Property Description
copy-from (string; Default: ) Copy data from specific router.
log (acct-fail | acct-ok | auth-fail | auth-ok; Default: auth-fail) To allow logging entries.
name (string; Default: ) Used to identify a router.
shared-secret (string; Default: )
use-coa (yes | no; Default: no)
customer (string; Default: ) Customer to a which router will be assigned.
ip-address (string; Default: ) Router IP address.

History

Sub-menu: /tool user-manager history


This subsection allows overviewing any changes confirmed in UM database. Some of them can be reverted back. 

[admin@MikroTik] /tool user-manager history> print
Flags: U - undoable, R - redoable, F - failed 
  ACTION                                                                                                                                                          SUB-CHANGES TIME                
U UMS customer test1 added                                                                                                                                                    may/22/2019 13:26:07
U UMS Profile test added                                                                                                                                                      may/22/2019 13:25:57
U multiple objects removed                                                                                                                                                    may/22/2019 12:02:37
U UMS customer customer1 added                                                                                                                                                may/22/2019 12:00:29
U UMS user user1 added                                                                                                                                                        may/22/2019 12:00:17
U UMS Profile testprofile added                                                                                                                                               may/22/2019 11:47:06
U multiple objects removed                                                                                                                                                  2 may/22/2019 11:14:53
U UMS user kkol added                                                                                                                                                         may/22/2019 10:53:57
U UMS user testtest added                                                                                                                                                     may/22/2019 10:45:53
U UMS Profile testu added                                                                                                                                                     may/22/2019 10:33:31
U UMS customer test added                                                                                                                                                     may/22/2019 10:09:35

Log

Sub-menu: /tool user-manager log


Logs are written when Authorization (auth) or Accounting (acct) requests from routers are received. 

[admin@MikroTik] > tool user-manager log print
 0 customer=admin user-orig="Client1" nas-port=15728780 nas-port-type=ethernet nas-port-id="bridge-to-clients" 
   calling-station-id="01:23:45:67:E1:BB" host-ip=172.16.16.1 status=authorization-failure time=may/23/2019 06:34:59 
   description="no valid profile found for user <Client1>"

Send User Manager related logging entries to the different device: 

/system logging add topics=manager,account action=remote
/system logging action set remote target=remote remote=192.168.88.1:514

Session

Sub-menu: /tool user-manager session


A session refers to a period when a user is using customer's services. It has nothing to do with User Manager web-page sessions. Flags: A - active 

[admin@MikroTik] > tool user-manager session print

 1 A customer=admin user="test" nas-port=15728795 nas-port-type=ethernet nas-port-id="bridge-to-clients" 
     calling-station-id="01:23:45:67:E1:BB" acct-session-id="81d0009b" user-ip=172.16.16.253 host-ip=172.16.16.1 
     status=start,interim from-time=may/23/2019 08:55:43 till-time=may/23/2019 09:25:43 uptime=30m download=38 upload=4533


Web Interface

To access User managers Web interface type IP address and /Userman at the end of it, for example, http://192.168.88.1/userman

Alt text
Default login is admin with empty password

Note: Since RouterOS 4.1, User-manager web interface is unreachable with an HTTP 404 when attempting to navigate to http://inside_ip/userman from behind a Hotspot interface where inside_ip is a non-NAT'd IP address on the router. Two workarounds: change the 'www' service port from 80 to something other than 80 or 8080, such as port 81. Then use http://inside_ip:81/userman, or use an IP address hotspot users are NAT'd to (http://outside_ip/userman) instead.


Configuration Examples

We will configure PPPoE with the RADIUS server authentication on the following setup:

Alt text
Setup where the PPPoE server uses a remote User Manager database for PPPoE client authentication, authorization and accounting. Both PPPoE server and PPPoE client are MikroTik routers, any other PPPoE client might be used instead.

On the client's (R1) router we configure PPPoE-client: 

[admin@R1] > /interface pppoe-client
add add-default-route=yes disabled=no interface=ether2 name=Client1 password=test user=test


Add RADIUS client to consult User Manager for PPP service
secret is equal to User Manager router secret. 192.168.79.24 is the User Manager router address. 

[admin@R2] > /radius
add address=192.168.79.24 secret=12345 service=ppp

There are 2 ways how to assign IP address for the PPPoE-client:

  • Create a pool from which assign IP addresses dynamically in the RADIUS client
  • Configure IP address manually in the RADIUS server
# Dynamically assign IP addresses
[admin@R2] > /ip pool
add name=pool1 ranges=192.168.79.30-192.168.79.50

Create a new one or update the default ppp profile: 

[admin@R2] > /ppp profile set [find name=default] remote-address=pool1 local-address=192.168.79.1

Enable user authentication via RADIUS. If entry in local secret database is not found, then client will be authenticated via RADIUS 

[admin@R2] > /ppp aaa
set use-radius=yes


On the RADIUS server (User Manager, R3):

Create your own or use by default already created Customer: 

[admin@R3] > /tool user-manager customer
set admin access=own-routers,own-users,own-profiles,own-limits,config-payment-gw

Create a profile which you will asing to user. can consist only a name (additional parameters can be updated later) 

[admin@R3] > /tool user-manager profile
add name=profile1

Configure User Manager (RADIUS server) communication with RADIUS client
192.168.79.1 is the IP address of the PPPoE-server router, shared-secret should match on both User Manager and PPPoE-server routers 

[admin@R3] >/tool user-manager router
add customer=admin ip-address=192.168.79.1 log=auth-fail name=router1 shared-secret=12345

Add a user which will authenificate through the RADIUS server. Previously mentioned static IP address should be configured in this sub-section under ip-address= parameter. 

/tool user-manager user
add customer=admin disabled=no password=test shared-users=1 username=test

Activate a user: 

[admin@R3] /tool user-manager> user create-and-activate-profile test customer=admin profile=profile1


Monitoring information from R1 device: 

[admin@R1] > interface pppoe-client monitor Client1 
          status: connected
          uptime: 1h48m42s
    active-links: 1
        encoding: 
    service-name: service1
         ac-name: R2
          ac-mac: 01:23:45:67:8D:49
             mtu: 1480
             mru: 1480
   local-address: 192.168.79.50
  remote-address: 192.168.79.1

Reference

Articles kept from User Manager in RouterOS v3+

Customer page

User page

User sign-up

User payments

Retrieved from "https://wiki.mikrotik.com/index.php?title=Manual:User_Manager&oldid=34226"